G.9 



£3 

m 



fee? 



SSI 



the output unit (AE) i 
of the telegram (T) a v 
communication relati 
connected periphera 

2 . A failsafe data inp 



channel for connecting 
for operating an autonja 
characterized in that 
triggers a test proce 
doing, effects a sta 




1. A method for operating an automation system, 

-the automation system having at least one input unit for 
receiving process signals and at leartst one output unit 
for driving external peripherals wmch are 
communicatively interconnected via/ a bus, 
characterized in that 

at least one of the input units And at least one of the 
output units are constructed as/failsafe input unit (EE) 
and failsafe output unit (AE) , /respectively ; 
the failsafe input unit (EE) 
the failsafe output unit (AE 
the telegram (T) includes a 
item (TN) , one destination 
the addressed output unit 
designating the transmitting 



ransmits a telegram (T) to 
determined times; 

useful information 
(TT) designating 
origin code (TS) 
unit (EE) ; 

n t i nuous r e cep t i on 
f an intact 
ise shifts the 
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at least one input 
isors f dgr use in a^m^thod 
'as recited in claim 1, 
.rgruit is provided which 
^determined times and, in so 
fe for at least one of the input 
channels of the faiLfeafe data input device, an internal logic 
monitoring the status change and, if necessary, outputting an 
error message, the /status change effected by the test circuit 
being canceled again at the end of the test procedure, and the 
test procedure being completely transparent for reading out 
the affected inmit channel. 



3 . A failsafe y&ata input device having at least one input 
channel for connecting peripheral sensors for use in a method 
for operating an automation system as recited in Claim 1, 
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characterized in that the at leapt one input channel is 
designed to be antivalent. 



4 . A failsafe data output devic 



having at least one output 



channel for connecting peripheral actuators for use in a 
method for operating an automation system as recited in Claim 
1, 

characterized in that a process 
processing user-designable log] 

unit evaluating the useful information (TN) of a received 
telegram (T) , subjecting the ufeeful information to the user- 
designable logic operation and/ driving the at least one output 
channel in accordance with the result of the logic operation. 



Lng unit is provided for 

operations, the processing 
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5. The failsafe data output dfevice as recited in Claim 4, 
characterized in that the processing unit monitors the time 
sequence of the process data/ transmitted with the useful 
information (TN) and drives /the at least one output channel 
only when the time sequence/of the d^fea required for driving 
the output channel lies witjhin predfeteinpined tolerances 



:e as 



6. The failsafe data outpuih devi 
characterized in that a monitor 
watchdog and monitoring the prqcessm 
monitoring circuit shifti/ng thd at 

into a safe state as sooy as a malfunction of the processing 
unit is detected. 



repited in Claim 4 or 5 , 
ng circuit constructed as 

vided, the 
ast one' output channel 



7. The failsafe data output device as recited in Claim 6, 
characterized in that tpe output channel, which can be driven 
by the processing unit J is constructed as a readback output 
channel, that the signal which can be supplied to the output 
channel can also be sirpplied to the monitoring circuit, that 
the monitoring circuit compares the signal supplied to it and 
the signal read back /from the output channel and, in response 
to deviations, shifts the affected output channel or all 
output channels into a safe state. 
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